Privacy Policy Analyzer

{
  "url": "https://www.notion.so"
}

{
  "_meta": {
    "payment": {
      "method": "x402",
      "price_usd": 0.324,
      "settlement_id": "0x1a7832ca14fddfe91a5a59ec0faf2bad1d244ec900b075e0209f45a8b0f1812a"
    },
    "capability": "privacy-policy-analyze",
    "latency_ms": 12056,
    "provenance": {
      "source": "www.notion.com",
      "fetched_at": "2026-06-16T01:24:25.542Z"
    }
  },
  "purposes": [
    "service delivery and functionality",
    "account management",
    "payment processing",
    "customer support",
    "newsletter registration",
    "analytics",
    "marketing and promotional purposes",
    "sweepstakes and contest administration",
    "business-to-business marketing and sales outreach",
    "contact auto-completion",
    "calendar integration functionality",
    "Notion Mail service provision",
    "advertising and personalized content delivery",
    "job application assessment",
    "improving and tailoring services"
  ],
  "source_url": "https://www.notion.com/trust/privacy-policy#california",
  "dpo_contact": null,
  "legal_basis": null,
  "user_rights": [
    "right to access information",
    "right to update information",
    "right to object to certain uses",
    "right to opt-out of tailored advertising",
    "right to control cookies and tracking technologies"
  ],
  "company_name": "Notion Labs, Inc.",
  "cookie_usage": "Uses cookies, pixel tags, local storage, and other tracking technologies. References separate Cookie Notice for detailed information. Third-party advertising partners place tracking technologies on browsers. Users can opt-out via Network Advertising Initiative, Digital Advertising Alliance, or Your Online Choices. Opt-outs may still result in non-tailored advertising.",
  "last_updated": "2024-04-10",
  "children_data": "Section 10 (Children's information) referenced but content not provided in excerpt",
  "third_parties": [
    "payment processors",
    "third-party analytics providers",
    "advertising technology partners",
    "ad networks and ad servers",
    "social networking sites",
    "third-party login services",
    "data enrichment providers",
    "Google (Contacts API, Gmail API, Directory API, Workspace API, Calendar API)",
    "third-party calendar service providers",
    "third-party conferencing providers"
  ],
  "data_collected": [
    "name",
    "email address",
    "password",
    "profile photo",
    "phone number",
    "mailing address",
    "payment information (processed by third parties)",
    "billing address",
    "transaction information",
    "IP address",
    "MAC address",
    "cookie identifiers",
    "mobile carrier",
    "mobile advertising identifiers",
    "browser details",
    "operating system",
    "device information",
    "location information (inferred from IP)",
    "Internet service provider",
    "browsing history",
    "click information",
    "interaction frequency and duration",
    "role within team/enterprise",
    "message contents and attachments",
    "survey responses",
    "job application materials (CV, cover letter)",
    "contact information from events",
    "Google Contacts data (when authorized)",
    "calendar and events data (when authorized)",
    "email message content (via Gmail API)",
    "contact and reply suggestions (via Directory API)",
    "workspace member contact data (via Workspace API)",
    "event response data (via Calendar API)"
  ],
  "missing_elements": [
    "specific data retention periods for different data types",
    "explicit legal bases for processing (consent, legitimate interest, contract, etc.)",
    "Data Protection Officer contact information",
    "specific countries or mechanisms for international data transfers (e.g., Standard Contractual Clauses, adequacy decisions)",
    "detailed automated decision-making and profiling disclosure",
    "right to lodge complaint with supervisory authority contact information",
    "explicit GDPR Article 6 legal basis statements",
    "specific CCPA/CPRA opt-out mechanisms and instructions",
    "data subject request response timeframes",
    "detailed children's data handling policy (section 10 content not provided)",
    "breach notification procedures",
    "processor vs. controller role clarification for different services",
    "California-specific rights details (section 12 content not provided)",
    "Data Privacy Framework details (section 13 content not provided)"
  ],
  "retention_periods": [
    "not specified"
  ],
  "ccpa_compliant_signals": [
    "Dedicated section 12 'Additional information for California residents'",
    "Policy addresses access and deletion rights",
    "Policy addresses opt-out of data sales/sharing and targeted advertising",
    "Specific mention of California residents' privacy rights"
  ],
  "gdpr_compliant_signals": [
    "Policy mentions 'Your privacy rights' section addressing user choices and objections",
    "Policy mentions 'Additional information for California residents' indicating jurisdiction-specific disclosures",
    "Policy includes 'Data privacy framework' section",
    "Policy addresses international data transfers",
    "Policy structure includes consent mechanisms for third-party integrations (Google Contacts, Calendar, etc.)",
    "Policy explicitly states users must 'authorize' access to calendar and conferencing data"
  ],
  "international_transfers": [
    "mentioned in section 4 (International data transfers) but details not provided in excerpt"
  ]
}